feat!: isolate privileged sandbox network operations per task

Run agent-mcp with an explicit asInvoker manifest and move WFP and loopback mutations into a fixed requireAdministrator helper under the release admin directory.

Add the Agent.Admin client and host projects with task-scoped runas launch, a logon-SID and Administrators-only local named pipe, remote-client rejection, mutual PID validation, strict versioned JSON framing, fixed network-only operations, and bounded messages.

Delay ACL and network Task Resource application until the first process_run. Verify executable identity, managed entry points, DNS snapshots, and normal-token WRITE_DAC access before elevation; reuse the helper only within the Task and keep elevation failures terminal without policy replanning.

Keep LPAC creation, executable approval, Job confinement, and ACL leases in the normal process. Make startup platform checks read-only, create the fixed Application Profile during apply, preserve dynamic WFP lifetime in the helper, and route persistent loopback recovery through the same elevated boundary.

Update recovery journaling, localized elevation and IPC errors, audit events, release publishing, manifests, README guidance, Specifications, Design, implementation records, and requirement traceability for the on-demand elevation model.

Add administrative-boundary, file-only no-elevation, elevation-terminal, lazy-resource, crash-recovery, manifest, IPC schema, and operational verification coverage. Verified Release build with zero warnings, Core 105/105, Planner 10/10, administrative boundary 4/4, elevated Windows suite 79/79, and published stdio/HTTP MCP E2E.

1 files changed, 87 insertions, 0 deletions

diff --git a/tests/Agent.Windows.Tests/AdministrativeBoundaryTests.cs b/tests/Agent.Windows.Tests/AdministrativeBoundaryTests.cs
new file mode 100644
index 0000000..b218072
--- /dev/null
+++ b/tests/Agent.Windows.Tests/AdministrativeBoundaryTests.cs
@@ -0,0 +1,87 @@
+using System.Buffers.Binary;
+using System.Text;
+using System.Text.Json;
+using Agent.Admin.Client;
+
+namespace Agent.Windows.Tests;
+
+public sealed class AdministrativeBoundaryTests
+{
+    [Fact]
+    public async Task Administrative_protocol_round_trips_only_the_fixed_network_request_shape()
+    {
+        var request = new AdminRequest(AdminProtocol.Version, "apply-network", Guid.NewGuid(), "S-1-15-2-1", "local",
+            [new("127.0.0.1", 11434)], false);
+        using var stream = new MemoryStream();
+        await AdminProtocol.WriteAsync(stream, request, TestContext.Current.CancellationToken);
+        stream.Position = 0;
+        AdminRequest actual = await AdminProtocol.ReadAsync<AdminRequest>(stream, TestContext.Current.CancellationToken);
+        Assert.Equal(request.Version, actual.Version);
+        Assert.Equal(request.Operation, actual.Operation);
+        Assert.Equal(request.TaskId, actual.TaskId);
+        Assert.Equal(request.ApplicationSid, actual.ApplicationSid);
+        Assert.Equal(request.NetworkAccess, actual.NetworkAccess);
+        Assert.Equal(request.OriginallyLoopbackExempt, actual.OriginallyLoopbackExempt);
+        Assert.Equal(request.Endpoints, actual.Endpoints);
+        string json = Encoding.UTF8.GetString(stream.ToArray());
+        Assert.DoesNotContain("executable", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("commandLine", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("securityDescriptor", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("layer", json, StringComparison.OrdinalIgnoreCase);
+        Assert.DoesNotContain("action", json, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task Administrative_protocol_rejects_oversized_messages_before_allocation()
+    {
+        byte[] header = new byte[4];
+        BinaryPrimitives.WriteInt32LittleEndian(header, AdminProtocol.MaxMessageBytes + 1);
+        using var stream = new MemoryStream(header);
+        await Assert.ThrowsAsync<InvalidDataException>(() => AdminProtocol.ReadAsync<AdminRequest>(stream,
+            TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task Administrative_protocol_rejects_fields_outside_the_fixed_schema()
+    {
+        byte[] payload = Encoding.UTF8.GetBytes("""{"version":1,"operation":"hello","taskId":"00000000-0000-0000-0000-000000000000","command":"cmd.exe"}""");
+        byte[] framed = new byte[payload.Length + 4];
+        BinaryPrimitives.WriteInt32LittleEndian(framed, payload.Length);
+        payload.CopyTo(framed.AsSpan(4));
+        using var stream = new MemoryStream(framed);
+
+        await Assert.ThrowsAsync<JsonException>(() => AdminProtocol.ReadAsync<AdminRequest>(stream,
+            TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public void Manifests_and_native_call_ownership_match_the_process_boundary()
+    {
+        string root = RepositoryRoot();
+        string mainManifest = File.ReadAllText(Path.Combine(root, "src", "Agent.App", "app.manifest"));
+        string helperManifest = File.ReadAllText(Path.Combine(root, "src", "Agent.Admin", "Agent.Admin.Host", "app.manifest"));
+        Assert.Contains("level=\"asInvoker\"", mainManifest, StringComparison.Ordinal);
+        Assert.Contains("level=\"requireAdministrator\"", helperManifest, StringComparison.Ordinal);
+        Assert.Contains("uiAccess=\"false\"", helperManifest, StringComparison.Ordinal);
+        string normalNative = File.ReadAllText(Path.Combine(root, "src", "Agent.Windows", "NativeMethods.txt"));
+        Assert.DoesNotContain("FwpmTransactionBegin0", normalNative, StringComparison.Ordinal);
+        Assert.DoesNotContain("FwpmFilterAdd0", normalNative, StringComparison.Ordinal);
+        Assert.DoesNotContain("NetworkIsolationSetAppContainerConfig", normalNative, StringComparison.Ordinal);
+        string helperNative = File.ReadAllText(Path.Combine(root, "src", "Agent.Admin", "Agent.Admin.Host", "NativeMethods.txt"));
+        Assert.Contains("FwpmTransactionBegin0", helperNative, StringComparison.Ordinal);
+        Assert.Contains("NetworkIsolationSetAppContainerConfig", helperNative, StringComparison.Ordinal);
+        string client = File.ReadAllText(Path.Combine(root, "src", "Agent.Admin", "Agent.Admin.Client", "ElevatedNetworkSession.cs"));
+        Assert.Contains("PipeRejectRemoteClients", client, StringComparison.Ordinal);
+    }
+
+    private static string RepositoryRoot()
+    {
+        DirectoryInfo? current = new(AppContext.BaseDirectory);
+        while (current is not null)
+        {
+            if (File.Exists(Path.Combine(current.FullName, "AgentSandboxMcp.slnx"))) return current.FullName;
+            current = current.Parent;
+        }
+        throw new DirectoryNotFoundException("Repository root was not found.");
+    }
+}